Critical severity · published Aug 1, 2025
CVE-2025-54574
Squid is a caching proxy for the Web
9.8
CVSS
24%
EPSS
No
On KEV
Description
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)24.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squid · Squid-cache
before 6.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54574
Patch
https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
Release Notes
https://github.com/squid-cache/squid/releases/tag/SQUID_6_4
Mitigation
https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/11/05/5
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html
More from Squid
9.8
CVE-2020-11945
An issue was discovered in Squid before 5.0.2
9.8
CVE-2019-12519
An issue was discovered in Squid through 4.7
9.8
CVE-2019-12524
An issue was discovered in Squid through 4.7
9.8
CVE-2019-12526
An issue was discovered in Squid before 4.9
9.8
CVE-2019-12525
An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.x through 4.7